Analysis
- max time kernel
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe
- Size 208KB
- Sample260802-tlehxscl9s
- SHA256 f6dd0ee9fdca1baf3ade745bc9fdb8bc9209c945a8f574fdcc7c354b51ed3740
- MD5 f7792e290e8008b7f05d8fc16dd635a0
- SHA1 0bf3b9eb5dfc0f6c0cd66b612e5b64f04b5d9c34
- SHA512 9aee6dd6749ec71cd1058648c44df311a9ef86f2d854df29b6751f083dcc9fd85ea7397f6b17ad0d1c6570963e560826d632000696ac1603028420580b112ee6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfU4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOMkEj1
- TLSH T12C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3220 MVYNF.exe 5592 DOI.exe 1496 WHY.exe 472 NPE.exe 1960 BNMNUXI.exe 2668 VARX.exe 1388 UTU.exe 2624 WRZHV.exe 720 GONTK.exe 5740 QMTOSCL.exe 5240 HXWEAQ.exe 2312 APLPKJ.exe 5312 KNRJRR.exe 5160 JYB.exe 1980 LWHTPOV.exe 2024 CEJ.exe 3308 YCBO.exe 4104 MHB.exe 2036 LSEPTGY.exe 436 PILP.exe 5800 IBAA.exe 6100 BEEECH.exe 2356 JJQLFO.exe 5884 JMUG.exe 6024 IXXWBJ.exe 3368 KVDRJS.exe 1404 JGOHR.exe 1824 EQW.exe 5256 IYDFK.exe 2292 KWQAZ.exe 4116 FCQ.exe 2812 JKXLNF.exe 2212 YAYD.exe 4724 MLOCIMC.exe 2584 GYTL.exe 3148 HBX.exe 3224 FCECH.exe 5960 USFUNR.exe 3484 JNPG.exe 5908 KQT.exe 5732 DLXGR.exe 3460 XGBPURQ.exe 4840 STGY.exe 2580 DMJRM.exe 3240 VMLWQW.exe 4976 TKWZD.exe 4952 TQXOM.exe 4500 ODBXOOO.exe 416 MOENXU.exe 2796 JTWUNXF.exe 4812 LOB.exe 4552 TECDE.exe 4092 FNJL.exe 2884 JDQLVVA.exe 3036 DQU.exe 4864 AVA.exe 1744 JWUXXC.exe 5888 KZG.exe 488 DUKWI.exe 4224 QFSVW.exe 2416 SSXEHTG.exe 1936 QNW.exe 800 PLHIYB.exe 2804 GLJNC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KNRJRR.exe APLPKJ.exe File opened for modification C:\windows\SysWOW64\PILP.exe LSEPTGY.exe File opened for modification C:\windows\SysWOW64\FCECH.exe HBX.exe File opened for modification C:\windows\SysWOW64\XGBPURQ.exe DLXGR.exe File created C:\windows\SysWOW64\TQXOM.exe.bat TKWZD.exe File created C:\windows\SysWOW64\QFSVW.exe DUKWI.exe File created C:\windows\SysWOW64\GONTK.exe WRZHV.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe BEEECH.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat IXXWBJ.exe File opened for modification C:\windows\SysWOW64\FCQ.exe KWQAZ.exe File created C:\windows\SysWOW64\TECDE.exe LOB.exe File created C:\windows\SysWOW64\FNJL.exe.bat TECDE.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe DUKWI.exe File created C:\windows\SysWOW64\PDJH.exe.bat ZIACKD.exe File created C:\windows\SysWOW64\KNRJRR.exe.bat APLPKJ.exe File created C:\windows\SysWOW64\XGBPURQ.exe.bat DLXGR.exe File opened for modification C:\windows\SysWOW64\KZG.exe JWUXXC.exe File created C:\windows\SysWOW64\PPYCD.exe.bat JPRPM.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe FLV.exe File created C:\windows\SysWOW64\FCTZQMG.exe ZBMLZ.exe File created C:\windows\SysWOW64\KVDRJS.exe IXXWBJ.exe File created C:\windows\SysWOW64\FCQ.exe.bat KWQAZ.exe File created C:\windows\SysWOW64\DLXGR.exe.bat KQT.exe File opened for modification C:\windows\SysWOW64\TECDE.exe LOB.exe File created C:\windows\SysWOW64\QNW.exe SSXEHTG.exe File created C:\windows\SysWOW64\GARJR.exe HHGTIM.exe File opened for modification C:\windows\SysWOW64\GARJR.exe HHGTIM.exe File created C:\windows\SysWOW64\GARJR.exe.bat HHGTIM.exe File created C:\windows\SysWOW64\NPE.exe.bat WHY.exe File created C:\windows\SysWOW64\BNMNUXI.exe NPE.exe File created C:\windows\SysWOW64\GONTK.exe.bat WRZHV.exe File created C:\windows\SysWOW64\FCECH.exe HBX.exe File opened for modification C:\windows\SysWOW64\ZSYUI.exe GARJR.exe File created C:\windows\SysWOW64\LHMTNU.exe.bat FLV.exe File created C:\windows\SysWOW64\BNMNUXI.exe.bat NPE.exe File created C:\windows\SysWOW64\TQXOM.exe TKWZD.exe File created C:\windows\SysWOW64\QNW.exe.bat SSXEHTG.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe PLNRCTN.exe File created C:\windows\SysWOW64\CWWQQEI.exe.bat PLNRCTN.exe File created C:\windows\SysWOW64\JJQLFO.exe BEEECH.exe File created C:\windows\SysWOW64\HBX.exe.bat GYTL.exe File created C:\windows\SysWOW64\FCECH.exe.bat HBX.exe File created C:\windows\SysWOW64\JWUXXC.exe AVA.exe File created C:\windows\SysWOW64\ZSYUI.exe.bat GARJR.exe File created C:\windows\SysWOW64\FCTZQMG.exe.bat ZBMLZ.exe File opened for modification C:\windows\SysWOW64\FHL.exe FCTZQMG.exe File opened for modification C:\windows\SysWOW64\BNMNUXI.exe NPE.exe File created C:\windows\SysWOW64\HXWEAQ.exe QMTOSCL.exe File created C:\windows\SysWOW64\SEMGKO.exe GLJNC.exe File opened for modification C:\windows\SysWOW64\YWOW.exe OYIC.exe File created C:\windows\SysWOW64\PILP.exe LSEPTGY.exe File created C:\windows\SysWOW64\YWOW.exe OYIC.exe File created C:\windows\SysWOW64\PPYCD.exe JPRPM.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe IXXWBJ.exe File created C:\windows\SysWOW64\FCQ.exe KWQAZ.exe File created C:\windows\SysWOW64\TECDE.exe.bat LOB.exe File opened for modification C:\windows\SysWOW64\FNJL.exe TECDE.exe File created C:\windows\SysWOW64\JWUXXC.exe.bat AVA.exe File created C:\windows\SysWOW64\KZG.exe.bat JWUXXC.exe File created C:\windows\SysWOW64\QFSVW.exe.bat DUKWI.exe File created C:\windows\SysWOW64\HBX.exe GYTL.exe File created C:\windows\SysWOW64\FNJL.exe TECDE.exe File opened for modification C:\windows\SysWOW64\DQU.exe JDQLVVA.exe File created C:\windows\SysWOW64\KWFW.exe LHMTNU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\UTU.exe VARX.exe File opened for modification C:\windows\USFUNR.exe FCECH.exe File opened for modification C:\windows\system\ODBXOOO.exe TQXOM.exe File created C:\windows\SSXEHTG.exe QFSVW.exe File created C:\windows\OVQO.exe UALFRNC.exe File opened for modification C:\windows\system\SSC.exe FHL.exe File created C:\windows\system\MHB.exe YCBO.exe File created C:\windows\system\ZIACKD.exe HMWZ.exe File opened for modification C:\windows\PLNRCTN.exe JYOQFQ.exe File opened for modification C:\windows\system\HHGTIM.exe OMCQ.exe File created C:\windows\system\SNKQNJM.exe.bat ZSYUI.exe File opened for modification C:\windows\IXXWBJ.exe JMUG.exe File created C:\windows\EQW.exe.bat JGOHR.exe File opened for modification C:\windows\YAYD.exe JKXLNF.exe File opened for modification C:\windows\system\GLJNC.exe PLHIYB.exe File opened for modification C:\windows\system\UALFRNC.exe EKKFKZ.exe File created C:\windows\BEEECH.exe IBAA.exe File opened for modification C:\windows\EQW.exe JGOHR.exe File created C:\windows\MLOCIMC.exe.bat YAYD.exe File created C:\windows\MOENXU.exe ODBXOOO.exe File opened for modification C:\windows\system\HMWZ.exe XEUUTI.exe File opened for modification C:\windows\system\ULDSUYU.exe SNKQNJM.exe File created C:\windows\system\ZLNFAP.exe.bat QLLZ.exe File opened for modification C:\windows\system\EKKFKZ.exe KWFW.exe File created C:\windows\JYB.exe.bat KNRJRR.exe File opened for modification C:\windows\system\YCBO.exe CEJ.exe File opened for modification C:\windows\LSEPTGY.exe MHB.exe File opened for modification C:\windows\MLOCIMC.exe YAYD.exe File created C:\windows\USFUNR.exe.bat FCECH.exe File created C:\windows\PLHIYB.exe.bat QNW.exe File created C:\windows\system\EKKFKZ.exe.bat KWFW.exe File created C:\windows\OVQO.exe.bat UALFRNC.exe File opened for modification C:\windows\DOI.exe MVYNF.exe File created C:\windows\system\MHB.exe.bat YCBO.exe File opened for modification C:\windows\MOENXU.exe ODBXOOO.exe File created C:\windows\DUKWI.exe.bat KZG.exe File opened for modification C:\windows\system\SNKQNJM.exe ZSYUI.exe File created C:\windows\GJWAQRX.exe WBUV.exe File opened for modification C:\windows\ZBMLZ.exe GJWAQRX.exe File created C:\windows\system\JGOHR.exe KVDRJS.exe File opened for modification C:\windows\system\JTWUNXF.exe MOENXU.exe File created C:\windows\system\LOB.exe JTWUNXF.exe File opened for modification C:\windows\system\LOB.exe JTWUNXF.exe File created C:\windows\system\LQKL.exe JSER.exe File created C:\windows\APLPKJ.exe.bat HXWEAQ.exe File opened for modification C:\windows\BEEECH.exe IBAA.exe File created C:\windows\system\LOB.exe.bat JTWUNXF.exe File created C:\windows\system\GLJNC.exe.bat PLHIYB.exe File created C:\windows\system\SNKQNJM.exe ZSYUI.exe File opened for modification C:\windows\system\JPRPM.exe YWOW.exe File opened for modification C:\windows\system\ZLNFAP.exe QLLZ.exe File created C:\windows\WBUV.exe OVQO.exe File opened for modification C:\windows\APLPKJ.exe HXWEAQ.exe File created C:\windows\system\YCBO.exe.bat CEJ.exe File opened for modification C:\windows\system\MHB.exe YCBO.exe File opened for modification C:\windows\IBAA.exe PILP.exe File created C:\windows\USFUNR.exe FCECH.exe File created C:\windows\system\JTWUNXF.exe MOENXU.exe File created C:\windows\system\HMWZ.exe.bat XEUUTI.exe File opened for modification C:\windows\system\KKDMNPX.exe PPYCD.exe File created C:\windows\system\WRZHV.exe UTU.exe File opened for modification C:\windows\QMTOSCL.exe GONTK.exe File created C:\windows\system\LWHTPOV.exe JYB.exe File created C:\windows\JDQLVVA.exe FNJL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 404 cmd.exe 5824 cmd.exe 2040 cmd.exe 5776 cmd.exe 1096 cmd.exe 5580 cmd.exe 2228 cmd.exe 5752 cmd.exe 5548 cmd.exe 4540 cmd.exe 4308 cmd.exe 5416 cmd.exe 1172 cmd.exe 1632 cmd.exe 5024 cmd.exe 1384 cmd.exe 5952 cmd.exe 3580 cmd.exe 4472 cmd.exe 1344 cmd.exe 4944 cmd.exe 2476 cmd.exe 1552 cmd.exe 2148 cmd.exe 4820 cmd.exe 3384 cmd.exe 3216 cmd.exe 4440 cmd.exe 4916 cmd.exe 4240 cmd.exe 4648 cmd.exe 2852 cmd.exe 3248 cmd.exe 3288 cmd.exe 2752 cmd.exe 5436 cmd.exe 5616 cmd.exe 1708 cmd.exe 6020 cmd.exe 1060 cmd.exe 2548 cmd.exe 4636 cmd.exe 2860 cmd.exe 5012 cmd.exe 5524 cmd.exe 5852 cmd.exe 1648 cmd.exe 1672 cmd.exe 4056 cmd.exe 3512 cmd.exe 3504 cmd.exe 5140 cmd.exe 5588 cmd.exe 4848 cmd.exe 1216 cmd.exe 4532 cmd.exe 4452 cmd.exe 3180 cmd.exe 2112 cmd.exe 5984 cmd.exe 4856 cmd.exe 1428 cmd.exe 4684 cmd.exe 5048 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1784 3692 WerFault.exe 87 4956 3220 WerFault.exe 93 3368 5592 WerFault.exe 99 2752 1496 WerFault.exe 104 880 472 WerFault.exe 109 4616 1960 WerFault.exe 113 5560 2668 WerFault.exe 119 3512 1388 WerFault.exe 124 1688 2624 WerFault.exe 129 5644 720 WerFault.exe 134 3108 5740 WerFault.exe 139 6120 5240 WerFault.exe 144 4540 2312 WerFault.exe 149 5360 5312 WerFault.exe 154 3124 5160 WerFault.exe 159 4968 1980 WerFault.exe 164 2672 2024 WerFault.exe 169 3420 3308 WerFault.exe 174 956 4104 WerFault.exe 179 2508 2036 WerFault.exe 184 5952 436 WerFault.exe 189 4820 5800 WerFault.exe 194 3404 6100 WerFault.exe 199 2808 2356 WerFault.exe 204 4956 5884 WerFault.exe 209 3440 6024 WerFault.exe 214 952 3368 WerFault.exe 219 2408 1404 WerFault.exe 224 4088 1824 WerFault.exe 229 5436 5256 WerFault.exe 234 2656 2292 WerFault.exe 239 6088 4116 WerFault.exe 244 1876 2812 WerFault.exe 249 4700 2212 WerFault.exe 254 5488 4724 WerFault.exe 259 5836 2584 WerFault.exe 264 1700 3148 WerFault.exe 269 5832 3224 WerFault.exe 274 416 5960 WerFault.exe 279 956 3484 WerFault.exe 284 2656 5908 WerFault.exe 289 4972 5732 WerFault.exe 294 4448 3460 WerFault.exe 299 2604 4840 WerFault.exe 304 2064 2580 WerFault.exe 309 5784 3240 WerFault.exe 314 4380 4976 WerFault.exe 319 2408 4952 WerFault.exe 324 3420 4500 WerFault.exe 329 3796 416 WerFault.exe 334 4816 2796 WerFault.exe 339 2640 4812 WerFault.exe 344 4364 4552 WerFault.exe 349 2888 4092 WerFault.exe 354 2364 2884 WerFault.exe 359 4140 3036 WerFault.exe 364 4728 4864 WerFault.exe 369 920 1744 WerFault.exe 374 5880 5888 WerFault.exe 379 4436 488 WerFault.exe 384 5568 4224 WerFault.exe 389 4820 2416 WerFault.exe 394 4700 1936 WerFault.exe 399 5516 800 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPYCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCECH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEEECH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLXGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYOQFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNRJRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKXLNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTWUNXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWUXXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMJRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKWZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWWQQEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLJNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APLPKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOENXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULDSUYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSER.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3692 2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe 3692 2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe 3220 MVYNF.exe 3220 MVYNF.exe 5592 DOI.exe 5592 DOI.exe 1496 WHY.exe 1496 WHY.exe 472 NPE.exe 472 NPE.exe 1960 BNMNUXI.exe 1960 BNMNUXI.exe 2668 VARX.exe 2668 VARX.exe 1388 UTU.exe 1388 UTU.exe 2624 WRZHV.exe 2624 WRZHV.exe 720 GONTK.exe 720 GONTK.exe 5740 QMTOSCL.exe 5740 QMTOSCL.exe 5240 HXWEAQ.exe 5240 HXWEAQ.exe 2312 APLPKJ.exe 2312 APLPKJ.exe 5312 KNRJRR.exe 5312 KNRJRR.exe 5160 JYB.exe 5160 JYB.exe 1980 LWHTPOV.exe 1980 LWHTPOV.exe 2024 CEJ.exe 2024 CEJ.exe 3308 YCBO.exe 3308 YCBO.exe 4104 MHB.exe 4104 MHB.exe 2036 LSEPTGY.exe 2036 LSEPTGY.exe 436 PILP.exe 436 PILP.exe 5800 IBAA.exe 5800 IBAA.exe 6100 BEEECH.exe 6100 BEEECH.exe 2356 JJQLFO.exe 2356 JJQLFO.exe 5884 JMUG.exe 5884 JMUG.exe 6024 IXXWBJ.exe 6024 IXXWBJ.exe 3368 KVDRJS.exe 3368 KVDRJS.exe 1404 JGOHR.exe 1404 JGOHR.exe 1824 EQW.exe 1824 EQW.exe 5256 IYDFK.exe 5256 IYDFK.exe 2292 KWQAZ.exe 2292 KWQAZ.exe 4116 FCQ.exe 4116 FCQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3692 2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe 3692 2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe 3220 MVYNF.exe 3220 MVYNF.exe 5592 DOI.exe 5592 DOI.exe 1496 WHY.exe 1496 WHY.exe 472 NPE.exe 472 NPE.exe 1960 BNMNUXI.exe 1960 BNMNUXI.exe 2668 VARX.exe 2668 VARX.exe 1388 UTU.exe 1388 UTU.exe 2624 WRZHV.exe 2624 WRZHV.exe 720 GONTK.exe 720 GONTK.exe 5740 QMTOSCL.exe 5740 QMTOSCL.exe 5240 HXWEAQ.exe 5240 HXWEAQ.exe 2312 APLPKJ.exe 2312 APLPKJ.exe 5312 KNRJRR.exe 5312 KNRJRR.exe 5160 JYB.exe 5160 JYB.exe 1980 LWHTPOV.exe 1980 LWHTPOV.exe 2024 CEJ.exe 2024 CEJ.exe 3308 YCBO.exe 3308 YCBO.exe 4104 MHB.exe 4104 MHB.exe 2036 LSEPTGY.exe 2036 LSEPTGY.exe 436 PILP.exe 436 PILP.exe 5800 IBAA.exe 5800 IBAA.exe 6100 BEEECH.exe 6100 BEEECH.exe 2356 JJQLFO.exe 2356 JJQLFO.exe 5884 JMUG.exe 5884 JMUG.exe 6024 IXXWBJ.exe 6024 IXXWBJ.exe 3368 KVDRJS.exe 3368 KVDRJS.exe 1404 JGOHR.exe 1404 JGOHR.exe 1824 EQW.exe 1824 EQW.exe 5256 IYDFK.exe 5256 IYDFK.exe 2292 KWQAZ.exe 2292 KWQAZ.exe 4116 FCQ.exe 4116 FCQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 1632 3692 2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe 89 PID 1632 wrote to memory of 3220 1632 cmd.exe 93 PID 3220 wrote to memory of 3468 3220 MVYNF.exe 95 PID 3468 wrote to memory of 5592 3468 cmd.exe 99 PID 5592 wrote to memory of 4412 5592 DOI.exe 100 PID 4412 wrote to memory of 1496 4412 cmd.exe 104 PID 1496 wrote to memory of 4636 1496 WHY.exe 105 PID 4636 wrote to memory of 472 4636 cmd.exe 109 PID 472 wrote to memory of 2476 472 NPE.exe 110 PID 2476 wrote to memory of 1960 2476 cmd.exe 113 PID 1960 wrote to memory of 1044 1960 BNMNUXI.exe 115 PID 1044 wrote to memory of 2668 1044 cmd.exe 119 PID 2668 wrote to memory of 1672 2668 VARX.exe 120 PID 1672 wrote to memory of 1388 1672 cmd.exe 124 PID 1388 wrote to memory of 2516 1388 UTU.exe 125 PID 2516 wrote to memory of 2624 2516 cmd.exe 129 PID 2624 wrote to memory of 4056 2624 WRZHV.exe 130 PID 4056 wrote to memory of 720 4056 cmd.exe 134 PID 720 wrote to memory of 5752 720 GONTK.exe 135 PID 5752 wrote to memory of 5740 5752 cmd.exe 139 PID 5740 wrote to memory of 2276 5740 QMTOSCL.exe 140 PID 2276 wrote to memory of 5240 2276 cmd.exe 144 PID 5240 wrote to memory of 3884 5240 HXWEAQ.exe 145 PID 3884 wrote to memory of 2312 3884 cmd.exe 149 PID 2312 wrote to memory of 2860 2312 APLPKJ.exe 150 PID 2860 wrote to memory of 5312 2860 cmd.exe 154 PID 5312 wrote to memory of 1904 5312 KNRJRR.exe 155 PID 1904 wrote to memory of 5160 1904 cmd.exe 159 PID 5160 wrote to memory of 404 5160 JYB.exe 160 PID 404 wrote to memory of 1980 404 cmd.exe 164 PID 1980 wrote to memory of 2752 1980 LWHTPOV.exe 165 PID 2752 wrote to memory of 2024 2752 cmd.exe 169 PID 2024 wrote to memory of 944 2024 CEJ.exe 170 PID 944 wrote to memory of 3308 944 cmd.exe 174 PID 3308 wrote to memory of 3180 3308 YCBO.exe 175 PID 3180 wrote to memory of 4104 3180 cmd.exe 179 PID 4104 wrote to memory of 5560 4104 MHB.exe 180 PID 5560 wrote to memory of 2036 5560 cmd.exe 184 PID 2036 wrote to memory of 3512 2036 LSEPTGY.exe 185 PID 3512 wrote to memory of 436 3512 cmd.exe 189 PID 436 wrote to memory of 4640 436 PILP.exe 190 PID 4640 wrote to memory of 5800 4640 cmd.exe 194 PID 5800 wrote to memory of 5356 5800 IBAA.exe 195 PID 5356 wrote to memory of 6100 5356 cmd.exe 199 PID 6100 wrote to memory of 3848 6100 BEEECH.exe 200 PID 3848 wrote to memory of 2356 3848 cmd.exe 204 PID 2356 wrote to memory of 4848 2356 JJQLFO.exe 205 PID 4848 wrote to memory of 5884 4848 cmd.exe 209 PID 5884 wrote to memory of 2848 5884 JMUG.exe 210 PID 2848 wrote to memory of 6024 2848 cmd.exe 214 PID 6024 wrote to memory of 5000 6024 IXXWBJ.exe 215 PID 5000 wrote to memory of 3368 5000 cmd.exe 219 PID 3368 wrote to memory of 5824 3368 KVDRJS.exe 220 PID 5824 wrote to memory of 1404 5824 cmd.exe 224 PID 1404 wrote to memory of 3904 1404 JGOHR.exe 225 PID 3904 wrote to memory of 1824 3904 cmd.exe 229 PID 1824 wrote to memory of 4240 1824 EQW.exe 230 PID 4240 wrote to memory of 5256 4240 cmd.exe 234 PID 5256 wrote to memory of 1540 5256 IYDFK.exe 235 PID 1540 wrote to memory of 2292 1540 cmd.exe 239 PID 2292 wrote to memory of 4212 2292 KWQAZ.exe 240 PID 4212 wrote to memory of 4116 4212 cmd.exe 244 PID 4116 wrote to memory of 5012 4116 FCQ.exe 245 PID 5012 wrote to memory of 2812 5012 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f7792e290e8008b7f05d8fc16dd635a0_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\MVYNF.exeC:\windows\MVYNF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOI.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\DOI.exeC:\windows\DOI.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\system\WHY.exeC:\windows\system\WHY.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPE.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\SysWOW64\NPE.exeC:\windows\system32\NPE.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNMNUXI.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\SysWOW64\BNMNUXI.exeC:\windows\system32\BNMNUXI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTU.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\system\UTU.exeC:\windows\system\UTU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMTOSCL.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\QMTOSCL.exeC:\windows\QMTOSCL.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXWEAQ.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\SysWOW64\HXWEAQ.exeC:\windows\system32\HXWEAQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APLPKJ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\APLPKJ.exeC:\windows\APLPKJ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\JYB.exeC:\windows\JYB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:404 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\windows\CEJ.exeC:\windows\CEJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCBO.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\windows\system\YCBO.exeC:\windows\system\YCBO.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSEPTGY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\LSEPTGY.exeC:\windows\LSEPTGY.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBAA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\IBAA.exeC:\windows\IBAA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEEECH.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\BEEECH.exeC:\windows\BEEECH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMUG.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\JMUG.exeC:\windows\JMUG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGOHR.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\system\JGOHR.exeC:\windows\system\JGOHR.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\EQW.exeC:\windows\EQW.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\windows\SysWOW64\KWQAZ.exeC:\windows\system32\KWQAZ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YAYD.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5548 -
C:\windows\YAYD.exeC:\windows\YAYD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLOCIMC.exe.bat" "68⤵PID:1072
-
C:\windows\MLOCIMC.exeC:\windows\MLOCIMC.exe69⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "70⤵PID:5452
-
C:\windows\GYTL.exeC:\windows\GYTL.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1552 -
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCECH.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1708 -
C:\windows\SysWOW64\FCECH.exeC:\windows\system32\FCECH.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFUNR.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3236 -
C:\windows\USFUNR.exeC:\windows\USFUNR.exe77⤵
- Executes dropped EXE
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNPG.exe.bat" "78⤵PID:5892
-
C:\windows\JNPG.exeC:\windows\JNPG.exe79⤵
- Executes dropped EXE
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:632 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLXGR.exe.bat" "82⤵PID:5232
-
C:\windows\SysWOW64\DLXGR.exeC:\windows\system32\DLXGR.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGBPURQ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4580 -
C:\windows\SysWOW64\XGBPURQ.exeC:\windows\system32\XGBPURQ.exe85⤵
- Executes dropped EXE
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STGY.exe.bat" "86⤵PID:1356
-
C:\windows\system\STGY.exeC:\windows\system\STGY.exe87⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMJRM.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\windows\system\DMJRM.exeC:\windows\system\DMJRM.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMLWQW.exe.bat" "90⤵PID:4544
-
C:\windows\VMLWQW.exeC:\windows\VMLWQW.exe91⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4540 -
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQXOM.exe.bat" "94⤵PID:3800
-
C:\windows\SysWOW64\TQXOM.exeC:\windows\system32\TQXOM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ODBXOOO.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5708 -
C:\windows\system\ODBXOOO.exeC:\windows\system\ODBXOOO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOENXU.exe.bat" "98⤵PID:4280
-
C:\windows\MOENXU.exeC:\windows\MOENXU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTWUNXF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5024 -
C:\windows\system\JTWUNXF.exeC:\windows\system\JTWUNXF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LOB.exe.bat" "102⤵PID:3348
-
C:\windows\system\LOB.exeC:\windows\system\LOB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2040 -
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNJL.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4308 -
C:\windows\SysWOW64\FNJL.exeC:\windows\system32\FNJL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDQLVVA.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1844 -
C:\windows\JDQLVVA.exeC:\windows\JDQLVVA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQU.exe.bat" "110⤵PID:2864
-
C:\windows\SysWOW64\DQU.exeC:\windows\system32\DQU.exe111⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVA.exe.bat" "112⤵PID:108
-
C:\windows\AVA.exeC:\windows\AVA.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWUXXC.exe.bat" "114⤵PID:3440
-
C:\windows\SysWOW64\JWUXXC.exeC:\windows\system32\JWUXXC.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZG.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\windows\SysWOW64\KZG.exeC:\windows\system32\KZG.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUKWI.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4648 -
C:\windows\DUKWI.exeC:\windows\DUKWI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFSVW.exe.bat" "120⤵PID:5780
-
C:\windows\SysWOW64\QFSVW.exeC:\windows\system32\QFSVW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-